The Parallels Plesk platform is used in thousands of installations worldwide. This software presents an automated control panel for end-user clients to choose and manage services. Administrators install this software on their servers to automate the tasks of hosting websites and much more. During installation, some complications can occur that cause Plesk not to be properly configured. Spammers targeting Plesk users and administrators can use misconfiguration like these to their benefit. We will discuss how a spammer could access this improperly disclosed information on nearly 120,000 misconfigured installations. We will see how the email addresses of server admins could be mined to support a sophisticated phishing or spam campaign to reveal their credentials.

Misconfiguration Leads to Disclosure
The first step to finding misconfigured Plesk servers is to understand how these misconfigurations look in the public domain. When Plesk is not configured properly, it displays a default message (see image below). These installations can be identified easily by using a search engine on the web such as Google. All one needs to do is search for web pages which have the string “Default PLESK Page” in the title.

The Plesk Default Page.

Once these pages have been located, the email addresses of their owners could be mined from the HTML using a simple script. In most cases, the email addresses embedded in a default page are different from the related WHOIS information. This alone is not a vulnerability in Plesk, however it seems that a piece of software like Plesk should not provide email addresses in a way that they are easily harvested by spammers. In some cases, we found that directories which contained sensitive information regarding file system layout and billing information were publicly accessible. Server administrators should be very conscientious about information disclosed in the default pages.

Conclusion
Plesk default pages could be located in thousands of installations. Spammers can easily harvest email addresses from these default pages. Once harvested, these emails could be used to launch a targeted phishing attack against server administrators to disclose administrator credentials. We encourage Plesk server administrators to not display email addresses via default pages. Perhaps, Plesk will rethink information displayed to the public via default pages as well.

More importantly, some webmasters are not even aware of the various misconfigurations which may leak sensitive information about their website and customers over the web.

Overview

This article is written to raise awareness of misconfiguration related to the domains they manage so more webmasters will pay attention. From our interaction with webmasters, we understand that they are already bogged down with many maintenance duties. However, the fact remains that misconfiguration errors, when left unaddressed, can spew important information into the hands of malicious persons.

An Example

Consider a website that we analyzed a few days ago, the URL looked like this:
hxxp://www.[scrubbed].net/forms/[scrubbed]/[scrubbed]/simple.log

This particular page was listing all email addresses that were registered on the website. These registrations may have been as a result of user requests to be put on a weekly newsletter of some sort. The page listed 623 email addresses, including addresses belonging to .mil, @gmail.com, @yahoo.com domains and more. The server was running an Apache/1.3.41 Server.

Conclusion

Though this incident may not have caused direct harm to the website, it is definitely undesirable to have an email address list laying out in the open. It only serves as fodder for spam bots and malicious persons to launch social engineering attacks.

In conclusion, webmasters, please do not leave your software installations in their default settings, and do pay attention to misconfiguration and other errors.

Most universities spend large sums of money buying IDS, IPS and Spam Filter technology and their various licenses. This should, at least in theory, allow universities to cut down on the number of such zombie machines by identifying tell tale signs of malicious communication and by analyzing their network traffic.

Experiment Goal

To understand if universities are harboring zombie machines, which can be used for spam campaigns.

Methodology

We have collected a list of 2070 universities. Each university’s DNS was queried to determine the IP address being used to host each website. This IP address was cross-referenced with data from Route Views to identify the AS number hosting that IP (using data from CAIDA). The AS number was then used to mine IP ranges advertised as BGP updates. Once the CIDR IP ranges were been found, the IPs in the CIDR range were checked with Spamhaus’s Zombie Blacklist. The experiment was conducted between March 12th and March 16th, 2010.

Our Observations

• Number of unique universities: 2070
• Number of Unique ASes observed: 829
• Total number of probed: 434,083 IPs
• Size of zombie blacklist: 2,130,944 IPs

Highlights

We present some interesting observations on the data analyzed.

• Only AS174, Cogent Communications, Inc., was found to contain zombies (see list below).
• Only 0.67% of educational institutions are associated with spam-zombie IP addresses.
• Only 0.12% of ASes seem contain spam-zombie IP addresses.

Frequency distribution of the number of IPs tested.

Conclusion

It seems that Universities are unfairly maligned by reports of zombies in their networks. Based on the findings of this preliminary set of experiments, having not found spam-zombie machines in large numbers in residence on university sub-nets, it seems that universities are doing a pretty good job of combating spam-zombies and keeping the Internet safe.

Till next time.

The following educational institutes were associated with AS174:

69.87.162.66     http://www.morehouse.edu/
164.68.1.24      http://www.lakeforest.edu/
38.105.70.154    http://www.mica.edu/
216.177.122.173  http://www.bmc.edu/
131.125.1.105    http://www.kean.edu/
38.115.20.155    http://www.medaille.edu/
38.107.150.150   http://www.stvincent.edu/
198.17.40.106    http://www.ursinus.edu/
38.98.251.141    http://www.vfcc.edu/
192.188.131.10   http://www.wju.edu/
38.109.194.106   http://www.rmcad.edu/
216.228.143.82   http://www.desu.edu/
38.105.74.129    http://www.udc.edu/
216.177.122.152  http://www.tcmi.org/
192.133.83.145   http://www.holycross.edu/
198.100.0.33     http://www.marymount.edu/

This “malvertising” is bad for the reputation of the website in question and because it opens up a Pandora’s box of security issues if a visitor decides to follow the link in the advertisement. In this short article we try to determine if certain subsets of the most popular 1 million Internet websites are more vulnerable to attack by spammers.

Experiment Goals

• Where are the spammers targeting their efforts?
• What kind of websites need to put more effort into stopping spammers?

Methodology

We obtained a list of the top 1 million websites from Alexa. We partitioned the list into 3 equal parts, designated as “top,” “middle” and “low” websites. From each subset, we randomly selected 1000 websites and determined if they were hosting spam advertisements.

To determine whether a site was hosting spam advertisements, we queried Google and other search engines with a list of keywords suggesting pharmacy spam (e.g. “buy Kamagra cheap” and “no prescription needed”). Once a website was found to include spam advertisements, the suspect pages from that website were downloaded to ensure that spam advertisements were indeed present.

Interesting Results

• The “top” tier was responsible for 9% of sites hosting spam ads.
• The “middle” tier was responsible for 4% of sites hosting spam ads.
• The “low” tier was responsible for 3% of sites hosting spam ads.

Conclusion

It is surprising to see that “top” ranking websites were more than twice as likely to have spam advertisements on their web pages than “middle” or “low” ranking websites.

It could be that spammers prefer to concentrate on the most popular sites versus the not-so-popular ones or that popular sites have more discussion/message boards that can be exploited. This question could be the basis of a more in-depth study of this phenomenon.

Examples of websites that host spam advertisements

Top sites:

www.pcd.go.th
www.blognone.com
www.howardforums.com
www.memeq.net
www.adrants.com

Middle sites:

www.rankarthai.com
www.pmg.org.za

Low sites:

www.nailshop.ro
www.simple-momreviews.com

Hackers employ two basic techniques:

• Creating large numbers of users on forums. These accounts are then used to post spam on the message boards.
• Exploiting Web Application vulnerabilities in the software used to run the forum.

Approximately two weeks ago, Lenny Zeltser, from ISC SANS, posted an informative article about online pharmacy ads popping up on message boards. In this vein we have conducted a limited experiment with about 14,000 websites which contain spam announcing online pharmacies.

The aim of the experiment:

• What percentage of websites which advertise online pharmacies are message boards and Internet forums?
• What Web Applications, e.g. CMS packages, are used on the message boards that are compromised?

We believe this will provide us with a rough estimate of how focused are hackers toward using message boards and forums on the Internet to advertise spam. From another perspective, it will provide us some idea of how vulnerable websites are if it hosts a message board or forum from being abused by hackers.

Testing methodology:

We have used Google to mine the websites which contain certain keyword patterns such as “buy zocor online”, or “buy brand kamagra online” etc. Once the links suggested by Google were mined, each of the websites was tested against Google’s Safe Browsing List to determine if they had hosted malware (according to Google). Next, an analysis was done to determine if the link(s) mined from Google pointed to a forum or message board. This was done by identifying the presence of multiple strings inside a link. For example, if a link has the keywords “topic”, “view”, “thread” or similar keywords, including characters associated with dynamic page generation, it is probably hosting a message board or forum.

The test was conducted between January 21st and January 23rd, 2010.

Popular software packages installed on compromised forums and message boards.

We present the most interesting results below:

• 47.9% of websites displaying “online pharmacy” spam are message boards and forums.
• None of the websites advertising “online pharmacy” spam were listed on Google Safe Browsing List.
• 20.28% of forums displaying “online pharmacy” spam were using Jquery.
• 15.73% of forums displaying “online pharmacy” spam were using phpBB.
• 11.54% of forums displaying “online pharmacy” spam were using WordPress.
• 10.84 % of forums displaying “online pharmacy” spam were using Mootools.

These results and other software packages, helper-scripts, tracking-code are depicted in the graph presented above.

This small experiment shows that a high percentage of websites displaying online spam campaigns are message boards or forums. This indicates that there are many unsecured software installations and older software packages still in use which are often exploited by malicious individuals to post spam. Further, it seems that most sites which were hacked are using jQuery. This supports our previous observations regarding jQuery scripts being used to push malware to unsuspecting visitors.

Below we present some sample links which lead to “online pharmacy” spam ads:

We strongly suggest that you do not visit the below sites.

hxxp://agingparents.com/blog/wp-comments.php?id_comments=1041
hxxp://agnitech.net/forums/viewtopic.php?f=2&t=426
hxxp://altlingo.com/community/members/zocor+online+24q.aspx
hxxp://aslansin.com/members/zocor-package-insert-26i/default.aspx
hxxp://beanbol.com/purchase-zocor-(simvastatin)-40-mg.html
hxxp://beanbol.com/zocor-(simvastatin)-20-mg.html
hxxp://blog.firestats.cc/
hxxp://blog.firestats.cc/49
hxxp://blogs.bet.com/music/soundOff/about/?cp=13
hxxp://blogs.greenpeace.ca/?proto=713
hxxp://blogs.greenpeace.ca/?proto=715
hxxp://blogs.inquirer.net/happynest/2009/10/09/just-sing/
hxxp://boards.tx-outdoors.com/viewtopic.php?f=2&t=467
hxxp://buy-cheap-zocor.hi5.com/
hxxp://cheapzocor.com/
hxxp://cheapzocor.com/about/
hxxp://coilhouse.net/?deppsa=710
hxxp://coilhouse.net/?deppsa=715
hxxp://community.burton.com/members/zocor+interaction+10a.aspx
hxxp://en.netlog.com/clan/BuyZocorOnline
hxxp://en.netlog.com/clan/zocor
hxxp://eostrava.cz/post-80523-cheap-zocor/
hxxp://f5fest.com/?p=50
hxxp://fans.askaninja.com/profiles/blogs/buy-zocor-no-prescription-buy
hxxp://feedblogger.net/members/cost-zocor-68l.aspx
hxxp://foros.canaljuegos.com/index.php?topic=1067891.0
hxxp://foro.toplatino.net/viewtopic.php?f=3&t=17031
hxxp://forsale.oodle.com/view/buy-zocor-online-and-treat-the-cholesterol-problems/1763399272-seattle-wa/
hxxp://forum.asian-autoparts.eu/viewtopic.php?p=4234&sid=82d1fc8ea8bf7189150dda0674d1d9b0
hxxp://forum.atiz.com/index.php?topic=362.msg665;topicseen
hxxp://forum.autonews.fr/index.php?showtopic=43369&view=getlastpost
hxxp://forum.jiwang.org/index.php?showtopic=44638
hxxp://forum.lugarcerto.com.br/viewtopic.php?f=13&t=1022
hxxp://forum.ronatvan.com/index.php?action=printpage;topic=3171.0
hxxp://forum.ronatvan.com/index.php?topic=3171.0
hxxp://forums.solmetra.com/viewtopic.php?f=2&t=67911
hxxp://forums.solmetra.com/viewtopic.php?f=3&t=48102
hxxp://forum.tag-board.com/showthread.php?p=70359
hxxp://forum.tarad.com/index.php?action=printpage;topic=23901.0
hxxp://forum.vachealait.com/viewtopic.php?f=3&t=123806
hxxp://forum.vachealait.com/viewtopic.php?f=5&t=124103
hxxp://forum.vladimirmedvedev.com/index.php?topic=190.0
hxxp://forum.vortue.com/showthread.php?p=114540
hxxp://gallopinghillcaterers.com/?page=buy-online-zocor&f=1262906101
hxxp://gameinformer.com/blogs/members/b/buy_zocor_warnings_blog/archive/2009/12/18/buy-zocor-warnings-pu4.aspx
hxxp://gameinformer.com/members/zocor_2D00_online/default.aspx
hxxp://gfestival.com/?pages=157
hxxp://gfestival.com/?pages=65
hxxp://grabhot.com/index.php?topic=2537.0
hxxp://groups.adobe.com/posts/534b2ec31b
hxxp://harvardcitizen.com/?zine=1144
hxxp://harvardcitizen.com/?zine=4200
hxxp://historias.masoportunidades.com.ar/?page_navg=3879
hxxp://ibls.com/cs/members/zocor+pricing+44n.aspx
hxxp://identi.ca/andres250
hxxp://identi.ca/zachery328
hxxp://innfromthenight.com/forum/viewtopic.php?f=28&t=57971&p=60406
hxxp://jackpenate.com/forum/viewtopic.php?pid=16485
hxxp://leegibbons.com/formbuilder/web/pharmacy/zocor/p=tricor-zocor.html
hxxp://letterheadforemail.com/Zocor.html
hxxp://mabonline.net/tablets-zocor-(simvastatin)-5-mg.html
hxxp://mabonline.net/zocor-(simvastatin)-for-sale.html
hxxp://matadornetwork.com/
hxxp://my.superbasket.gr/viewtopic.php?f=4&t=1562&p=2139
hxxp://naturalpet-com.safepages.com/showthread.php?t=1071
hxxp://networking.bizjournals.com/Jonny2
hxxp://noprescriptiononlinepharmacy.ca/zocor.html
hxxp://pastebin.ca/1743811
hxxp://pornknight.com/zocor-depression-t14855.html
hxxp://posterous.com/people/37qTcxHC297r
hxxp://punkrock.org/buyzocoronline1075&v=comments
hxxp://ranahan.dephan.go.id/forum/viewtopic.php?f=2&t=6803
hxxp://responsiblemarketing.com/blog/?generic=3880
hxxp://room.vicman.net/viewtopic.php?f=2&t=147874
hxxp://room.vicman.net/viewtopic.php?f=4&t=147047
hxxp://technorati.com/blogs/zocorlinks.blogspot.com
hxxp://thebristolfestival.org/README.php?tbf=746
hxxp://theevonyforum.com/online-zocor-purchase-buy-cheap-zocor-t433.html?sid=c64462e6e1214d18ea22e365c76aa13d
hxxp://thisis50.ning.com/forum/topics/buy-zocor-from-a-usa-pharmacy
hxxp://tk-twk.nets.hk/viewtopic.php?f=42&t=11427
hxxp://tohanschik.ru/viewtopic.php?t=1380&view=previous&sid=5ccac30f7095c3421d89b8a3c16a23a4
hxxp://twit88.com/home/node/10289
hxxp://virb.com/rushots/posts/text/6881665
hxxp://visualstudiogallery.msdn.microsoft.com/it-IT/4ec90b81-93e4-4435-b627-4410e6028af9?persist=True
hxxp://webradiocharts.eu/forum/viewtopic.php?f=4&t=376
hxxp://wiki.pylonshq.com/display/~heetley/BUY+Zocor+LOWEST+prices+NOW
hxxp://wiki.pylonshq.com/display/~heetley/BUY+Zocor+LOWEST+prices+NOW?showComments=true&showCommentArea=true
hxxp://www.247-pharmacy.com/buy/zocor.php
hxxp://www.abbeyproperties.co.uk/config.php?set_user=1&s=1264
hxxp://www.abbeyproperties.co.uk/config.php?set_user=1&s=1996
hxxp://www.aldaracreamonline.co.uk/buy-zocor.htm
hxxp://www.antidepressantscheaper.com/
hxxp://www.aperitto.com/support/forum/12-emr-suite/511-meridian-two-bit-pharmacy-appraiser-it
hxxp://www.articlesbase.com/health-articles/online-pharmacy-offers-the-most-competitive-prices-on-zocor-869351.html
hxxp://www.atalasoft.de/cs/members/zocor+400+mg+53b.aspx
hxxp://www.avatarpress.com/2010/01/22/post-80540-buy-zocor/
hxxp://www.blogged.com/topics/zocor/
hxxp://www.bowlofcereal.net/viewtopic.php?f=5&t=99
hxxp://www.brbooks.co.uk/zocor-(simvastatin)-10-mg-free-shipping.html
hxxp://www.canadianhealthcaremall.net/drug-zocor123.shtml
hxxp://www.canamericaglobal.com/products/Zocor/20/
hxxp://www.chemistdirect.co.uk/zocor-simvastatin-10-mg-tablets_4_12038.html
hxxp://www.chemistdirect.co.uk/zocor-simvastatin-40-mg-tablets_4_12040.html
hxxp://www.chop.edu/forum/user/profile/12110.page
hxxp://www.clockworkpharmacy.com/zocor-heart-pro-tablets-10mg.html
hxxp://www.copykatchat.com/
hxxp://www.cruisersforum.com/forums/members/inxgwo32-30799.html
hxxp://www.daanbantayan.gov.ph/dbforums/viewtopic.php?f=26&t=43370
hxxp://www.daanbantayan.gov.ph/dbforums/viewtopic.php?f=28&t=43373
hxxp://www.divingleisurelondon.co.uk/forum/online-zocor
hxxp://www.drugs-s.com/product-35-prd_12.html
hxxp://www.elakiri.com/forum/showthread.php?p=6341304
hxxp://www.europeanirish.com/index.php?med_id=buy-zocor-(simvastatin)-10-mg
hxxp://www.europeanirish.com/index.php?med_id=buy-zocor-(simvastatin)-40-mg
hxxp://www.fastcompany.com/tag/pharmacy
hxxp://www.feld.com/blog/archives/2007/02/buy-zocor-online.html
hxxp://www.feld.com/blog/archives/2007/02/online-buy-zocor-without-a-prescription.html
hxxp://www.fioricetpharmacy.info/product.php?prod=Zocor
hxxp://www.flexyx.com/Z/Zocor.html
hxxp://www.folkd.com/go/zocor+lipitor
hxxp://www.forkncork.com/?p=80540
hxxp://www.forkncork.com/?p=80544
hxxp://www.freecodesource.com/user/profile-354708.html
hxxp://www.freecodesource.com/user/profile-354802.html
hxxp://www.genbrand-rx.com/Zocor.html
hxxp://www.genericmedsfromcanada.com/
hxxp://www.genericmedsfromcanada.com/ZOCOR_80_mg_GENERIC_SIMVASTATIN_80_mg_28_Tabs_p/sim0753b.htm
hxxp://www.genericsmed.com/buy-cheap-generic-zocor-simvastatin-p-21.html
hxxp://www.genv.net/en-us/node/10875
hxxp://www.giustiziere.org/viewtopic.php?f=7&t=10277
hxxp://www.globaltrainingcenter.com/news.php?node=1412
hxxp://www.globaltrainingcenter.com/news.php?node=682
hxxp://www.goprocamera.com/admin/_js/tiny_mce/themes/advanced/files/buying-zocor-legally.html
hxxp://www.goprocamera.com/admin/_js/tiny_mce/themes/advanced/files/buy-zocor-without-a-prescription.html
hxxp://www.gradcats.org/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=2&node=2156
hxxp://www.gradcats.org/index.php?option=com_content&view=section&layout=blog&id=1&Itemid=2&node=3753
hxxp://www.gripenet.pt/blog/?p=80521
hxxp://www.gripenet.pt/blog/?p=80528
hxxp://www.hcs.harvard.edu/~salient/site/?menus=715
hxxp://www.hip-hop.net/profile/buyzocorG9FG
hxxp://www.hip-hop.net/profile/Fredmd
hxxp://www.hkcd-team.net/viewtopic.php?f=7&t=284
hxxp://www.ibiblio.org/agray/brushd/cheapest-price-for-zocor-40-mg.html
hxxp://www.ibiblio.org/agray/brushd/does-effect-have-libido-womens-zocor.html
hxxp://www.inansurucukursu.com/inan/forum/index.php?topic=2153.0;wap2
hxxp://www.inyoursuburb.com.au/forum/viewtopic.php?f=25&t=12069
hxxp://www.ipetitions.com/petition/buy_ambien_online_480/
hxxp://www.kucasnova.net/index.php?topic=1911.0
hxxp://www.kucasnova.net/index.php?topic=2378.0
hxxp://www.last.fm/user/zocor7103
hxxp://www.lerpg.com/forum/index.php?topic=1716.0
hxxp://www.livestrong.com/zocor-side-effects/
hxxp://www.mahalo.com/answers/drugs/where-can-you-buy-lipitor-online-is-it-cheaper
hxxp://www.makingthings.com/wiki/document.zocor-online-order
hxxp://www.masterseek.com/q/Zocor/0/1/Zocor.htm
hxxp://www.mathleagueforum.com/viewtopic.php?f=2&t=41
hxxp://www.menieresforum.com/?q=node/132
hxxp://www.michwine.com/index.php?Itemid=148&option=com_jcalpro&Subitem=3562
hxxp://www.michwine.com/index.php?Itemid=148&option=com_jcalpro&Subitem=773
hxxp://www.mister-wong.com/topics/zocor/
hxxp://www.mombu.com/hdtv/hdtv/t-buy-lipitor-online-no-prescription-needed-3828654.html
hxxp://www.mypage.com/buyzocor862/extendedprofile
hxxp://www.nfu.org/forum/archive/index.php?t-20956.html
hxxp://www.numberstemplates.com/forums/showthread.php?t=977
hxxp://www.offshorerx.com/drug/buy_generic_zocor.htm
hxxp://www.online-drugstore-usa.com/cheap_cardiovascular_prices/buy_generic_zocor_pills
hxxp://www.onlinepillspro.com/buy/zocor.html
hxxp://www.oxygenoverkill.com/forum/viewtopic.php?f=2&t=15
hxxp://www.pharmacyescrow.com/s3737-s-ZOCOR.aspx
hxxp://www.pharmacyescrow.com/s41524-s-ZOCOR.aspx
hxxp://www.photography-now.net/help/index?no-rx=1475
hxxp://www.photography-now.net/katja_oluscha_grunther/index?no-rx=3348
hxxp://www.pillsforall.com/cholesterol-lowering/zocor-40mg-generic-x-60/prod_57.html
hxxp://www.pillwatch.com/product/zocor/
hxxp://www.postnewsline.com/2009/04/the-post-new-website.html
hxxp://www.praktikum.de/forum/online-zocor-purchase-prescription-zocor-t12436.html
hxxp://www.psicologico.cl/?favorite=4356
hxxp://www.pyzam.com/profile/3304209
hxxp://www.pyzam.com/profile/3304382
hxxp://www.rfidtalk.com/showthread.php?p=19119
hxxp://www.rottentomatoes.com/vine/showthread.php?p=16528906
hxxp://www.rottentomatoes.com/vine/showthread.php?t=709353
hxxp://www.scribd.com/doc/25364786/buy-cheap-Generic-Zocor-Simvastatin-20mg-online-without-prescription
hxxp://www.server2go-web.de/forumng/index.php?topic=111147.0
hxxp://www.spurs11.com/forum/showthread.php?t=69947
hxxp://www.teamhallpass.com/2010/01/post-80522-buy-zocor/
hxxp://www.teamhallpass.com/2010/01/post-80527-about-zocor/
hxxp://www.technieuws.org/?p=83598
hxxp://www.technieuws.org/?p=83620
hxxp://www.tempuspharmacy.org/zocor-drug-information.html
hxxp://www.theartofthepossible.net/?p=83620
hxxp://www.theunforsaken.com/viewtopic.php?f=3&t=7668&p=8971
hxxp://www.thisis50.com/xn/detail/784568:Topic:18648223?xg_source=activity
hxxp://www.travelersnation.com/forum/post774.html
hxxp://www.tumblr.com/tagged/saints+&amp%3B+sinners
hxxp://www.twit88.com/home/node/10117
hxxp://www.valuepharmaceuticals.com/medicine/index.php
hxxp://www.wehopres.org/?p=83620
hxxp://www.wikio.com/article/122956318
hxxp://www.wikio.com/sports/football/football_players/michael_koenen
hxxp://www.wizard101.pl/forum/buy-zocor-drugs-online-zocor-t296.html
hxxp://www.world-drugs.net/order_generic_zocor.php
hxxp://www.xlpharmacy.com/
hxxp://www.xlpharmacy.com/generic-zocor/
hxxp://www.zenpharmacy.com/Zocor/buy-prescription-Zocor-online.html
hxxp://zocoronline130.typepad.com/blog/2010/01/buy-zocor-estrogen.html
hxxp://36poker.ru/forum/index.php?topic=2188.0
hxxp://ad-bu.chavalar.com/forum/index.php?topic=124.0
hxxp://alexatutor.com/viewtopic.php?f=2&t=838&p=915
hxxp://articlet.com/article7179.html
hxxp://bb.obscurusfio.com/index.php?topic=279.msg406
hxxp://bb.peak2010.org/viewtopic.php?f=2&t=31619
hxxp://bbs.qqcipher.com/viewtopic.php?f=2&t=51
hxxp://benthanhgold.com/forum/viewtopic.php?f=8&t=1487
hxxp://biblioteca.uniminuto.edu/index.php/biblioteca-en-cifras/1297?task=view&page=975
hxxp://bigcuzinent.com/forum/index.php?topic=29.0
hxxp://blog.see3.net/?p=484
hxxp://blogs.inquirer.net/m-ph/2008/08/29/nikon-d90-official-1st-dslr-with-hd-video-recording/
hxxp://boards.tx-outdoors.com/viewtopic.php?f=2&t=343
hxxp://buycheapviagra.ca/kamagra.html
hxxp://buycialis20mg.com/buy-kamagra-soft-tabs.htm
hxxp://buy-kamagra-online.net/
hxxp://carolinadelnorte.jomc.unc.edu/?optin=com_pharma&rr=buy-kamagra-viagra-india.php
hxxp://carolinaweek.jomc.unc.edu/?option_pharma=viagra-uk-kamagra.php
hxxp://centovacast.com/viewtopic.php?f=9&t=182
hxxp://centovacast.com/viewtopic.php?f=9&t=218
hxxp://chemisaxli.gov.ge/forum/viewtopic.php?id=76060
hxxp://citkim.phpbboy.com/viewtopic.php?f=2&t=734&p=734
hxxp://community.bonnaroo.com/service/displayKickPlace.kickAction?u=13803616&as=12058
hxxp://community.essence.com/forum/topics/how-to-buy-online-kamagra
hxxp://cooperation-of-benzin.de/viewtopic.php?f=2&t=3726
hxxp://district9140ng.org/index.php?topic=11.0
hxxp://ekkanisayoluganda.org.uk/furum/index.php?topic=19289.0
hxxp://essenceonline.ning.com/forum/topics/buy-kamagra-drugsorder-chep
hxxp://fahrerservice.org/viewtopic.php?f=2&t=1830
hxxp://fanclub.darabubamara.eu/viewtopic.php?f=3&t=2701
hxxp://fanclub.darabubamara.eu/viewtopic.php?f=4&t=2687
hxxp://feelmaldives.com/forum/viewtopic.php?f=2&t=36
hxxp://foorum.kundaliniyoga.ee/viewtopic.php?f=2&t=5526
hxxp://fora.an-archos.com/viewtopic.php?t=134335&sid=f3287141aaa40ea1970e3e8d53279b27
hxxp://forocientifico.com/viewtopic.php?f=2&t=179
hxxp://foros.comfusion.es/index.php?topic=675.0
hxxp://forum.acme.nu/index.php?topic=12.0
hxxp://forum.ampirstyle.ru/viewtopic.php?f=6&t=53
hxxp://forumas.vtv.lt/index.php?topic=4192.0
hxxp://forum.atlaspronet.net/showthread.php?t=80150
hxxp://forum.autonews.fr/index.php?showtopic=42109&view=getlastpost
hxxp://forum.auto.ro/showthread.php?t=505005
hxxp://forum.cudaswiata.pl/viewtopic.php?f=6&t=488
hxxp://forum.cudaswiata.pl/viewtopic.php?f=7&t=485
hxxp://forum.dayment.com/viewtopic.php?f=14&t=19
hxxp://forum.delifisek.net/index.php?topic=6.0
hxxp://forum.djlanka.com/viewtopic.php?f=2&t=20547
hxxp://forum.egypt.com/enforum/programming-languages-f84/buy-cheap-generic-kamagra-online-kamagra-no-prescription-39580.html
hxxp://forum.faazmagazine.com/index.php?topic=153.0
hxxp://forum.familyguy.cz/viewtopic.php?f=6&t=1215
hxxp://forum.fsbw.de/viewtopic.php?f=1&t=543
hxxp://forum.geotorrents.com/index.php?showtopic=455183&view=getnewpost
hxxp://forum.gwteambuilder.de/index.php?topic=1516.0
hxxp://forum.im1music.net/index.php?topic=13695.0
hxxp://forum.jurutera.net/viewtopic.php?f=5&t=6
hxxp://forum.jzip.com/archive/index.php/t-194030.html
hxxp://forum.livetoride.cz/viewtopic.php?f=2&t=5
hxxp://forum.masseriadelpino.it/viewtopic.php?f=2&t=850
hxxp://forum.matura.pl/viewtopic.php?f=4&t=17054
hxxp://forum.matura.pl/viewtopic.php?f=7&t=17150
hxxp://forum.montages-electroniques.com/viewtopic.php?t=5824&sid=a19708674cddb891449e7c154a5fbaaa
hxxp://forum.muzsweet.com/viewtopic.php?f=4&t=3502&p=23454
hxxp://forum.opensourceassets.com/index.php?topic=10.0
hxxp://forum.parrucchieritalia.it/viewtopic.php?f=3&t=1374
hxxp://forum.plovdivairport.com/index.php?topic=8792.0
hxxp://forum.pngarnet.ac.pg/viewtopic.php?f=2&t=36593
hxxp://forum.pngarnet.ac.pg/viewtopic.php?f=2&t=36701
hxxp://forum.polymus.ru/index.php?topic=2345.0;wap2
hxxp://forum.rimsketoplice.net/viewtopic.php?f=5&t=721
hxxp://forums.beerke.nl/viewtopic.php?f=4&t=4319
hxxp://forums.deviationsonline.com/viewtopic.php?f=7&t=407
hxxp://forums.deviationsonline.com/viewtopic.php?f=7&t=421
hxxp://forum.sibautobroker.ru/viewtopic.php?f=5&t=4
hxxp://forums.salug.org/index.php?action=printpage;topic=286.0
hxxp://forums.stevengould.org/viewtopic.php?t=37126&sid=964c4c68b15e636529dbd54f2ab791a3
hxxp://forum.ti.itb.ac.id/index.php?topic=2844.0
hxxp://forum.toniderassi.com/viewtopic.php?f=5&t=25
hxxp://forum.transimagovideo.com/index.php?topic=34.0
hxxp://forum.ultravnc.fr/index.php?topic=2274.0
hxxp://forum.wayfinder.com/index.php?topic=40.0;wap2
hxxp://generics-sale.com/product/kamagra-soft-flavoured.html
hxxp://generic-viagra-kamagra.com/
hxxp://generic-viagra-kamagra.com/kamagra.php
hxxp://habbo-aktuell.net/forum/viewtopic.php?f=5&t=1640
hxxp://heldentaten-gilde.com/viewtopic.php?f=6&t=41
hxxp://innfromthenight.com/forum/viewtopic.php?f=14&t=52817
hxxp://jeepinohio.com/forum/viewtopic.php?f=8&t=3712
hxxp://khaz.de/viewtopic.php?f=2&t=1051
hxxp://knolstuff.com/forum/topics/buy-kamagra-online-1
hxxp://laissezfaire.ru/viewtopic.php?f=3&t=4282
hxxp://laser-inkjet-labels.com/viewtopic.php?f=2&t=228
hxxp://laser-inkjet-labels.com/viewtopic.php?f=2&t=57
hxxp://legalrxlist.com/
hxxp://letterheadforemail.com/Kamagra.html
hxxp://medicine.bizrate.co.uk/oid651048929.html
hxxp://medicine.bizrate.co.uk/oid651048949.html
hxxp://messageboard.wrolc.org/index.php?action=printpage;topic=2811.0
hxxp://messageboard.wrolc.org/index.php/topic,2811.msg2826.html
hxxp://my.superbasket.gr/viewtopic.php?f=4&t=1592
hxxp://online-pill-store.com/
hxxp://paintballtokod.hu/forum/viewtopic.php?f=2&t=6
hxxp://permai.gov.my/forum/viewtopic.php?f=3&t=22558
hxxp://picpost.rootsee.com/index.php?topic=150.0
hxxp://pokerqc.ca/viewtopic.php?f=4&t=667
hxxp://poradny.rodinaaja.cz/viewtopic.php?f=4&t=703
hxxp://pravoedelo-spb.ru/forum/viewtopic.php?f=2&t=5
hxxp://program.kralchat.net/kamagra.html
hxxp://realmomsguide.sheknows.com/?q=kamagra
hxxp://redrum-demos.net/forum/index.php?topic=672.0;wap2
hxxp://registrar.fiu.edu/typo3_cache/a/index.html
hxxp://rozbeans.com/forum/viewtopic.php?p=15276
hxxp://sietereinos.com/viewtopic.php?f=8&t=10
hxxp://sitagu.info/community/index.php?topic=49.0
hxxp://slowebdev.net/viewtopic.php?f=4&t=6
hxxp://snsdfan.com/forum/viewtopic.php?f=2&t=4
hxxp://socbaytravel.com/forum/viewtopic.php?f=4&t=603
hxxp://socbaytravel.com/forum/viewtopic.php?f=4&t=697
hxxp://sonsofanarchyboards.com/viewtopic.php?f=2&t=12
hxxp://sorsogon.gov.ph/discussion/viewtopic.php?f=2&t=47576
hxxp://southernorcleague.com/forums/index.php?topic=149.0
hxxp://spainleds.com/viewtopic.php?f=2&t=965
hxxp://tatilyorum.net/viewtopic.php?f=2&t=7
hxxp://techexchange.packeteer.com/viewtopic.php?f=4&p=18467
hxxp://theevonyforum.com/post1915.html
hxxp://thememoryhole.org/?s=kandu+v
hxxp://thewallsoflove.com/forums/viewtopic.php?f=4&t=8
hxxp://thisis50.ning.com/xn/detail/784568:Topic:18422720?xg_source=activity
hxxp://thisis50.ning.com/xn/detail/784568:Topic:18869853?xg_source=activity
hxxp://tra.tools4noobs.com/support-f2/where-buy-kamagra-online-the-lowest-drugs-online-offers-t88.html
hxxp://twit88.com/home/node/9933
hxxp://velociteen.com/forum/index.php?action=printpage;topic=1643.0
hxxp://virb.com/cialiss91m
hxxp://vitsearkiv.net/viewtopic.php?f=9&t=34
hxxp://waltham2.financialchat.com/blogs/online-generic-kamagra-without-prescription
hxxp://web.kc.ac.th/viewtopic.php?f=2&t=1454
hxxp://web.kc.ac.th/viewtopic.php?f=2&t=1578
hxxp://www.365pharmacy.co.uk/
hxxp://www.3tabs.com/viagra/kamagra.html
hxxp://www.acauch.com/foro/viewtopic.php?f=2&t=4
hxxp://www.alismed.com/
hxxp://www.arvuroma.it/forum/viewtopic.php?f=2&t=2131
hxxp://www.bacila.com/forum/viewtopic.php?f=3&t=3925
hxxp://www.backyardsteamtrains.com/viewtopic.php?f=2&t=659
hxxp://www.bellspharmacy.com/
hxxp://www.bellspharmacy.com/category/4/kamagra.html
hxxp://www.bestpharmacy4u.com/kamagra/
hxxp://www.blogcatalog.com/topic/buy+kamagra+oral+jelly+uk/
hxxp://www.blogcatalog.com/topic/kamagra+100mg/
hxxp://www.britishsteelcollection.org.uk/index.php?option=com_contact&view=contact&id=6:community&catid=45:sponsors&Itemid=59
hxxp://www.bvkportal.com/phpbb3/viewtopic.php?f=4&t=20
hxxp://www.carolinamartialartsforum.com/viewtopic.php?f=7&t=39
hxxp://www.caverta-silagra.com/
hxxp://www.cheapest-prescription-drugs.biz/
hxxp://www.classicrockmagazine.com/forum/viewtopic.php?f=4&t=733&p=8913
hxxp://www.classicrockmagazine.com/forum/viewtopic.php?f=9&p=8914
hxxp://www.clubprivedesire.com/forum/viewtopic.php?f=6&t=257
hxxp://www.coffeeshopnieuwvennep.nl/viewtopic.php?f=2&t=471
hxxp://www.columbusunderground.com/wonder-bread-bakery-in-italian-village-to-close
hxxp://www.daanbantayan.gov.ph/dbforums/viewtopic.php?f=9&t=1419
hxxp://www.devourofmugthol.com/forums/index.php?topic=109.0
hxxp://www.drontlen.com/forum/viewtopic.php?f=4&t=253&p=374
hxxp://www.drontlen.com/forum/viewtopic.php?f=4&t=259
hxxp://www.ekaport.ru/forum/showthread.php?t=14099
hxxp://www.ekaport.ru/forum/showthread.php?t=14127
hxxp://www.family-online-pharmacy.com/purchase_men___s_health_generic/
hxxp://www.family-online-pharmacy.com/purchase_men___s_health_generic/buy_cheap_brand_kamagra_oral_jelly_online.html
hxxp://www.folkd.com/go/kamagra+ajanta+pharma
hxxp://www.forodevinos.com/viewtopic.php?f=3&t=55
hxxp://www.forum4voip.com/viewtopic.php?f=1&t=38125
hxxp://www.forum.tripudiolatino.it/viewtopic.php?f=2&t=165
hxxp://www.freewebs.com/costaescorts/
hxxp://www.geistheiler24.de/forum/viewtopic.php?f=11&p=5217
hxxp://www.generatedata.com/forums/index.php?topic=2351.msg2495
hxxp://www.getdarker.com/forums/viewtopic.php?f=3&t=5797&start=0
hxxp://www.gourmet.com/forums/message.jspa?messageID=1481
hxxp://www.healthpharmarx.com/
hxxp://www.hollywood.com/Forums/Home.aspx?plckForumPage=ForumDiscussion&plckDiscussionId=Cat%3ACelebsForum%3A41Discussion%3Ac7c7096b-9895-497f-bb0d-a79fd53fc8f1
hxxp://www.homegrow.me/where-to-buy-mestinon-online-fast-worldwide-shipping-the-m-t504.html
hxxp://www.hunglay.com/webboard/index.php?action=printpage;topic=26.0
hxxp://www.hunglay.com/webboard/index.php?topic=26.0
hxxp://www.infotop.ro/forum/viewtopic.php?f=2&t=4
hxxp://www.inox.tarrea.cl/foro/index.php?showtopic=68&view=old
hxxp://www.ireallywantviagra.com/2009/11/cheap-kamagra-oral-jelly.html
hxxp://www.jamespot.com/a/188474-Buy-Kamagra-Online.html
hxxp://www.jobsstack.com/forum/index.php?action=printpage;topic=4405.0
hxxp://www.jomc.unc.edu/
hxxp://www.joomlatemplatesearcher.com/forum/index.php?action=printpage;topic=7362.0
hxxp://www.joomlatemplatesearcher.com/forum/index.php?topic=7362.msg%msg_id%
hxxp://www.kamagra.in/India-Kamagra.htm
hxxp://www.kamagra-online.co.uk/aurogratablets.asp
hxxp://www.kamagrastore.co.uk/
hxxp://www.kamagratop.com/
hxxp://www.led-tv-fernseher.de/forum/viewtopic.php?f=4&t=4
hxxp://www.makinem.net/forum/index.php?topic=952.0
hxxp://www.malerxpharmacy.com/product/sildenafil-kamagra.html
hxxp://www.minco.com/community/members/Dr+Levitra.aspx
hxxp://www.mister-wong.com/topics/buy+cheapest/
hxxp://www.mister-wong.com/topics/kamagra/
hxxp://www.mypage.com/viagralive/weblog
hxxp://www.nnenyy-cs.info/viewtopic.php?f=8&t=943
hxxp://www.oktmilya.ru/viewtopic.php?p=13782
hxxp://www.onlinemedicalstore.net/
hxxp://www.online-pharmacy-usa.com/men___s_health_drugs/buy_propecia_online
hxxp://www.oxygenoverkill.com/forum/viewtopic.php?f=2&t=4
hxxp://www.partyoffers.co.uk/forum/read.php?19,400,400
hxxp://www.pdsanlazzaro.it/forum/viewtopic.php?f=3&t=2878
hxxp://www.perlenhimmel.at/viewtopic.php?p=16661
hxxp://www.photoactions.co.uk/Discount-Kamagra.htm
hxxp://www.photoactions.co.uk/Jelly_Kamagra_Liquid.htm
hxxp://www.phtclub.be/viewtopic.php?f=8&t=253
hxxp://www.pills2go.com/
hxxp://www.pioneer-physicaltherapy.com/buy-generic-kamagra+soft-online.html
hxxp://www.portaldocuidador.com/forum/viewtopic.php?f=6&t=4212
hxxp://www.promiana-bg.com/forum/index.php?action=printpage;topic=3072.0
hxxp://www.promiana-bg.com/forum/index.php?topic=2777.0
hxxp://www.ps3planet.it/forum/viewtopic.php?f=4&t=10090
hxxp://www.pyzam.com/profile/3318196
hxxp://www.pyzam.com/profile/3318197
hxxp://www.realpharmacyrx.com/
hxxp://www.reasonfrontier.com/index.php?action=printpage;topic=2791.0
hxxp://www.redleafwands.com/ehsrp/index.php?action=printpage;topic=14534.0
hxxp://www.rfidtalk.com/showthread.php?p=18965
hxxp://www.rhettmiller.com/forum/viewtopic.php?f=3&t=1449
hxxp://www.rottentomatoes.com/vine/showthread.php?p=16465556
hxxp://www.rugbyveneto.org/phpbb//viewtopic.php?t=59630
hxxp://www.scribd.com/doc/23935277/Buy-Kamagra-Online-Without-Prescription-Best-Place-to-Buy-Kamagra
hxxp://www.scribd.com/doc/25069184/buy-Brand-Kamagra-oral-jelly-Sildenafil-citrate-100mg-online-without-prescription
hxxp://www.sharpmeds.com/
hxxp://www.simpy.com/user/mastsiagoel/tag/generic4all
hxxp://www.skaly.sk/viewtopic.php?f=6&t=3009
hxxp://www.skydsl.org/forum/viewtopic.php?p=12035&sid=594e5b80965d00e1ae83a04c1ee6eb5c
hxxp://www.skydsl.org/forum/viewtopic.php?t=5999&sid=2254d3872dbd467413cde299664fd2a8
hxxp://www.somalinet.com/forums/viewtopic.php?f=8&t=231252
hxxp://www.songstowearpantsto.com/forum/viewtopic.php?f=3&t=118055
hxxp://www.ssteve.nl/forum/viewtopic.php?f=2&t=105
hxxp://www.stalkerzone.de/forum/viewtopic.php?f=3&t=2568
hxxp://www.stalkerzone.de/forum/viewtopic.php?f=5&t=2642&p=22695
hxxp://www.surcentro.com/en/info/www.kamagrarx.com
hxxp://www.tebene.de/Members/Kamagra/buy-kamagra-online-paypal-payment
hxxp://www.thegeneric-viagra.net/
hxxp://www.thegreatpotdebate.com/forum/topic48.html?sid=ac9e1defb50abca2e1cff33a76d91bdb
hxxp://www.theviagrastore.com/kamagra-generic-store-1095.html
hxxp://www.thewealthacademy.co.uk/index.php?topic=1135.0
hxxp://www.tuneando.es/index.php?action=printpage;topic=1705.0
hxxp://www.tuneando.es/index.php?topic=1705.0
hxxp://www.vertifight.com/forum/viewtopic.php?f=3&p=63126
hxxp://www.vibeystars.nl/index.php?topic=35.0
hxxp://www.vinilkosmo-mp3.com/forum/index.php?topic=201.0
hxxp://www.wbahealth.com/product_brand_kamagra_soft_online.html
hxxp://www.wordcountbuddies.com/wcb_forum_test/viewtopic.php?f=4&p=286
hxxp://www.worstpreviews.com/forums/showthread.php?p=42881
hxxp://www.xlpharmacy.com/ed-jelly/
hxxp://www.xlpharmacy.com/Kamagra/
hxxp://www.xmaspharmacy.com/kamagra-oral-jelly-100mg-p-59.html
hxxp://www.xmaspharmacy.com/resource/index.html
hxxp://www.your-best-drugstore.com/
hxxp://www.zeroegg.cn/viewtopic.php?f=4&t=10674

UPDATE: On 3/9/2010, hxxp://runbetterpoker.com/viewtopic.php?f=4&t=887 was removed from the list at the owner’s request. Software used to run the forum whose vulnerability led to the recent abuse has been removed.